How to download the trivy-checks

[huntermcd]

Description

Documentation for how to download trivy-checks is missing the new oras command.

docker command results in an error (expected)
docker pull ghcr.io/aquasecurity/trivy-checks:1
1: Pulling from aquasecurity/trivy-checks
unsupported media type application/vnd.cncf.openpolicyagent.config.v1+json

but the oras command also has an error;
\oras pull ghcr.io/aquasecurity/trivy-checks:1
✓ Skipped application/vnd.cncf.openpolicyagent.config.v1+json 0/0 B 100.00% 0s
└─ sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
✓ Pulled bundle.tar.gz 156/156 kB 100.00% 35ms
└─ sha256:16957b935ef82529bc26f3ceeeb60d798c90ef142d25e3715ab4478b204ed1bb
✓ Pulled application/vnd.oci.image.manifest.v1+json 563/563 B 100.00% 0s
└─ sha256:ae151c4eecf35c507d8f866121ddfbf46540b041bc7bca7cdd8d9f70ceb6f12c
Skipped pulling layers without file name in "org.opencontainers.image.title"
Use 'oras copy ghcr.io/aquasecurity/trivy-checks:1 --to-oci-layout ' to pull all layers.

Link

https://github.com/aquasecurity/trivy-checks/pkgs/container/trivy-checks

Suggestions

correction on how to download the checks db.

[simar7]

Seems to be fine for me

oras pull ghcr.io/aquasecurity/trivy-checks:1
Downloading 16957b935ef8 bundle.tar.gz
Downloaded  16957b935ef8 bundle.tar.gz
Pulled [registry] ghcr.io/aquasecurity/trivy-checks:1
Digest: sha256:ae151c4eecf35c507d8f866121ddfbf46540b041bc7bca7cdd8d9f70ceb6f12c

[huntermcd]

I run the same command (both on redhat and windows) and get the same skipped

./oras pull ghcr.io/aquasecurity/trivy-checks:1
✓ Skipped     application/vnd.cncf.openpolicyagent.config.v1+json                                                                                                                                                                                                                                                                                                0/0  B 100.00%     0s
  └─ sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
✓ Pulled      bundle.tar.gz                                                                                                                                                                                                                                                                                                                                  156/156 kB 100.00%    3ms
  └─ sha256:16957b935ef82529bc26f3ceeeb60d798c90ef142d25e3715ab4478b204ed1bb
✓ Pulled      application/vnd.oci.image.manifest.v1+json                                                                                                                                                                                                                                                                                                     563/563  B 100.00%     0s
  └─ sha256:ae151c4eecf35c507d8f866121ddfbf46540b041bc7bca7cdd8d9f70ceb6f12c
Skipped pulling layers without file name in "org.opencontainers.image.title"
Use 'oras copy ghcr.io/aquasecurity/trivy-checks:1 --to-oci-layout <layout-dir>' to pull all layers.

I am using version 1.2.0

./oras version
Version:        1.2.0
Go version:     go1.22.3
Git commit:     dcef719e208a9b226b15bc6512ad729a7dd93270
Git tree state: clean

[nikpivkin]

Hi @huntermcd !

This is not the Trivy documentation page, but the GitHub page where the package is hosted. See the documentation for information on how to download the package.

The first layer is a configuration layer with size 0:

oras manifest fetch ghcr.io/aquasecurity/trivy-checks:1 --pretty
{
  "schemaVersion": 2,
  "mediaType": "application/vnd.oci.image.manifest.v1+json",
  "config": {
    "mediaType": "application/vnd.cncf.openpolicyagent.config.v1+json",
    "digest": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
    "size": 0
  },
  "layers": [
    {
      "mediaType": "application/vnd.cncf.openpolicyagent.layer.v1.tar+gzip",
      "digest": "sha256:16957b935ef82529bc26f3ceeeb60d798c90ef142d25e3715ab4478b204ed1bb",
      "size": 159763,
      "annotations": {
        "org.opencontainers.image.title": "bundle.tar.gz"
      }
    }
  ],
  "annotations": {
    "org.opencontainers.image.created": "2024-10-02T00:46:10Z"
  }
}

Therefore, it was skipped, which is not an error.

[hudac]

Maybe helpful:

Documentation says trivy-checks:0. But it should be rather trivy-checks:1.

A simple example how to copy to a private registry, e.g. this one worked for me via skopeo:

skopeo copy --all docker://ghcr.io/aquasecurity/trivy-db:2 docker://myregistry.local/trivy-db:2
skopeo copy --all docker://ghcr.io/aquasecurity/trivy-java-db:1 docker://myregistry.local/trivy-java-db:1
skopeo copy --all docker://ghcr.io/aquasecurity/trivy-checks:1 docker://myregistry.local/trivy-checks:1